Privacy Policy

Who we are

Bapita builds and runs booking websites and owner dashboards for small businesses in Israel — hair salons, nail and lash studios, clinics, and short term rentals. We build the site for the owner, we host it, and we keep it running. We are a small team and we care about keeping your data safe.

This policy covers two different people, and it is worth being clear which one you are:

• Business owners — our customers, who have a Bapita account and a booking site we built.
• Clients and guests — the people who book an appointment or a stay through one of those sites. If that is you, the business you booked with decides what happens to your data. We hold it on their behalf, and we do not use it for anything of our own.

What data we collect

• Contact forms and calls: name, business name, phone number, and email when you ask us to get in touch or book a call with us. Calls are scheduled through Calendly, which receives the details you enter on its own booking form.
• Owner accounts: your email, a hashed password, your business details, your services and prices, your working hours, your staff, and any photos you give us.
• Bookings:client name, phone number, email, appointment or stay dates and times, the service booked, and any note the client leaves. This is the business owner's data, held by us on their behalf.
• Payments: where a business has payments switched on, the amount, the status, and the reference of the transaction. See Payments below — we never see or store card numbers.
• Google account data: only where an owner explicitly connects one. See Connecting a Google account below.
• Product usage and analytics: pages visited and features used, so we can see what works. See Analytics and cookies below.
• Push notifications: if an owner turns them on, a browser-issued subscription token so new bookings can reach their phone. It identifies a browser, not a person, and it is deleted when notifications are turned off.

How we use your data

• Run the booking site and dashboard we built for you
• Send booking confirmations and reminders
• Take and reconcile payments where that is switched on
• Answer your questions and support you
• Improve the product
• Meet our legal and tax obligations
• Prevent fraud and abuse

We do not sell your data, we do not rent it, and we do not use a business's client list for our own marketing.

Payments

Where a business has online payments switched on, the payment itself is processed by Green Invoice and its clearing partner Grow, who are the payment processors of record. The client is sent to their secure payment page to enter card details.

Card numbers, CVV codes and expiry dates never reach Bapita. We never see them, we never store them, and they are never in our database. What we store is the transaction reference, the amount, the currency and the status, so a booking can be marked paid and an owner can reconcile their takings. Green Invoice also issues the tax document for the transaction, which means the client's name and email are shared with them for that purpose. Their handling of that data is governed by their own privacy policy.

Connecting a Google account

A business owner can connect their Google Calendar so that bookings and busy time stay in step. This is entirely optional, it is never done for you, and nothing is connected until you complete Google's own consent screen.

When it is connected, we:

• read busy times from the calendar you selected, so a slot you are already committed to is not offered to a client;
• write bookings taken through Bapita into that calendar, so your day is in one place.

We do not read the contents of unrelated events, we do not touch any other Google service, and we do not use Google data for advertising or sell it to anyone. Bapita's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect at any time from your dashboard settings, or revoke access directly in your Google account permissions. Disconnecting deletes the access tokens we hold.

Analytics and cookies

We use two analytics tools on bapita.com:

• Plausible Analytics — cookieless and privacy focused. It sets no cookies, stores no personal data, and does not track anyone across sites. It tells us how many people visited a page, and nothing about who they are.
• Google Analytics 4 — this one does set first party cookies (such as _ga) in your browser, and sends usage data to Google. We use it for aggregate traffic reporting only. You can block it with your browser's cookie settings, a tracker blocker, or Google's own opt-out add-on.

The booking sites we build for our customers also carry a session cookie where one is needed to keep a booking or a login working. Those are strictly functional — nothing is used for advertising.

Where your data is stored

Our database and file storage run on Supabase, and the application is hosted on Vercel. Transactional email is sent through our email providers. All of these may process and store data in data centres outside Israel. We use encryption in transit and at rest, row level access controls so one business can never read another's data, and regular backups.

Who we share it with

We do not sell, rent, or share personal data with third parties for marketing. We share it only with the service providers who make the product work — the hosting, database, email, payment and analytics providers named above, each under their own terms — and where we are required to by law or a court order, or where it is necessary to protect the security of our services.

How long we keep it

• Active accounts: as long as the account is open.
• After you cancel: your account and its data are deleted 30 days after the subscription ends. Ask us before then and we will export it for you first.
• Bookings and client records: deleted with the account they belong to, subject to the exception below.
• Payment and invoice records: kept for as long as Israeli tax law requires us and Green Invoice to keep them, which is longer than the 30 days above and which we cannot shorten on request.
• Enquiries that never became customers: deleted within 24 months.
• Analytics:aggregate only, and held to the provider's own retention period.

Your rights

You have the right to:

• Request a copy of the personal data we hold about you
• Ask us to correct anything that is wrong
• Ask us to delete your data, subject to the retention rules above
• Opt out of marketing communications at any time
• Disconnect a connected Google account at any time
• Block cookies in your browser settings

If you booked an appointment or a stay with a business that uses Bapita, contact that business first — it is their record. We will help them action it. To exercise any of these rights with us directly, email info.bapita@gmail.com.

Children

Bapita is a tool for businesses and is not directed at children. We do not knowingly collect data from anyone under 16. If a booking was made for a child by a parent or guardian, that record belongs to the business it was made with.

Changes to this policy

We may update this privacy policy from time to time. If we make material changes, we'll notify you by email or a prominent notice on our website. Your continued use of our services means you accept the updated policy.

Questions?

If you have any questions about our privacy practices, please contact us at info.bapita@gmail.com.